Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2016-06-24 14:58:46	2016-06-24 15:01:12	146 seconds	1.2

File Details

File name

34.apk

File size

172725 bytes

File type

Java archive data (JAR)

CRC32

CC9D41AE

MD5

1937228887ffe62f846ba8026f4da303

SHA1

eaebe093c8c0d0300066c25e126d279afc4ab087

SHA256

b11c78852876a41cf0f855d15693112433a980192fdfcc0d2d40190935617789

SHA512

bd523681b16dfe40a00e485978ac641eeff4ca8a8eb07f752bfa8e93e4305430f8fb1b5d3af429f9e1771cf6904154e41b809c4f2b556c3945ae70e805d0441d

Ssdeep

None

PEiD

None matched

Yara

None matched

VirusTotal

Permalink
VirusTotal Scan Date: 2016-01-17 01:07:06
Detection Rate: 36/54 (Expand)

Antivirus	Version	Result
Ad-Aware	3.0.2.1015	Android.Trojan.Zitmo.A
AegisLab	1.5	Clean
Agnitum	5.5.1.3	Clean
AhnLab-V3	2016.01.18.00	Android-Trojan/Zitmo.5e82
Alibaba	1.0	A.H.Pay.KungFu.A
ALYac	1.0.1.8	Clean
Antiy-AVL	1.0.0.1	Trojan[Spy]/AndroidOS.Zitmo.a
Arcabit	1.0.0.642	Android.Trojan.Zitmo.A
Avast	8.0.1489.320	Android:Zitmo-L [Trj]
AVG	16.0.0.4489	Android/Zitm
Avira	8.3.2.4	ANDROID/Spy.Zitmo.C.Gen
AVware	1.5.0.21	Trojan.AndroidOS.Generic.A
Baidu-International	3.5.1.41473	Trojan.Win32.Agent.AaA
BitDefender	7.2	Android.Trojan.Zitmo.A
Bkav	1.3.0.7400	Clean
ByteHero	1.0.0.1	Clean
CAT-QuickHeal	14.00	Android.Zitmo.D
CMC	1.1.0.977	Clean
Comodo	23983	UnclassifiedMalware
Cyren	5.4.16.7	AndroidOS/Zitmo.A
DrWeb	7.0.17.11230	Android.SmsSend.3695
Emsisoft	3.5.0.642	Android.Trojan.Zitmo.A (B)
ESET-NOD32	12883	a variant of Android/Spy.Spitmo.E
F-Prot	4.7.1.166	AndroidOS/Zitmo.A
F-Secure	11.0.19100.45	Trojan:Android/SmsSpy.G
Fortinet	5.1.220.0	Clean
GData	25	Android.Trojan.Zitmo.A
Ikarus	T3.1.9.5.0	Trojan.AndroidOS.Zitmo
Jiangmin	16.0.100	TrojanSpy.AndroidOS.axu
K7AntiVirus	9.212.18451	Trojan ( 003eb2571 )
K7GW	9.212.18451	Trojan ( 003eb2571 )
Kaspersky	15.0.1.13	HEUR:Trojan-Banker.AndroidOS.Zitmo.a
Malwarebytes	2.1.1.1115	Clean
McAfee	6.0.6.653	Android/Spitmo
McAfee-GW-Edition	v2015	Android/Spitmo
Microsoft	1.1.12400.0	Trojan:AndroidOS/Zitmo.C
MicroWorld-eScan	12.0.250.0	Android.Trojan.Zitmo.A
NANO-Antivirus	1.0.14.5380	Trojan.Android.Panda.cwzgnd
nProtect	2016-01-15.02	Clean
Panda	4.6.4.2	Clean
Qihoo-360	1.0.0.1077	Trojan.Android.Gen
Rising	25.0.0.18	APK:Trojan.Zbot.e/Android!7.119C [F]
Sophos	4.98.0	Andr/Zitmo-C
SUPERAntiSpyware	5.6.0.1032	Clean
Symantec	20151.1.0.32	Android.Zeusmitmo
TheHacker	6.8.0.5.809	Clean
TotalDefense	37.1.62.1	Clean
TrendMicro	9.740.0.1012	Clean
TrendMicro-HouseCall	9.800.0.1009	Clean
VBA32	3.12.26.4	Clean
VIPRE	46586	Trojan.AndroidOS.Generic.A
ViRobot	2014.3.20.0	Clean
Zillya	2.0.0.2616	Trojan.Zitmo..18
Zoner	1.0	Clean

Android Application Info

Package	com.security.service
Main Activity	com.security.service.MainActivity

Activities

Activity Name
com.security.service.MainActivity

Receivers

Receiver Action
android.intent.action.BOOT_COMPLETED
android.intent.action.USER_PRESENT
android.provider.Telephony.SMS_RECEIVED
android.intent.action.REBOOT
android.intent.action.ACTION_SHUTDOWN

Permissions

Signatures

File has been identified by at least one AntiVirus on VirusTotal as malicious (Osint)

Application Asks For Dangerous Permissions (Static)

File has been identified by more the 10 AntiVirus on VirusTotal as malicious (Osint)

Domain	IP Address
2.android.pool.ntp.org	212.18.3.18
2.android.pool.ntp.org.8.8.8.8
mtalk.google.com

File Details

Android Application Info

Activities

Receivers

Permissions

Signatures

Android Static Analysis

Static CHANGE_COMPONENT_ENABLED_STATE Method Calls

Static ACCESS_NETWORK_STATE Method Calls

Static SEND_SMS Method Calls

Static VIBRATE Method Calls

Screenshots

Network Analysis

Hosts Involved

DNS Requests

Volatility

Api Call
1 Landroid/support/v4/net/ConnectivityManagerCompat$BaseConnectivityManagerCompatImpl;->isActiveNetworkMetered(Landroid/net/ConnectivityManager;)Z (0x2) ---> Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo;
1 Landroid/support/v4/net/ConnectivityManagerCompatGingerbread;->isActiveNetworkMetered(Landroid/net/ConnectivityManager;)Z (0x2) ---> Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo;
1 Landroid/support/v4/net/ConnectivityManagerCompatHoneycombMR2;->isActiveNetworkMetered(Landroid/net/ConnectivityManager;)Z (0x2) ---> Landroid/net/ConnectivityManager;->getActiveNetworkInfo()Landroid/net/NetworkInfo;

Api Call
1 Lcom/security/service/receiver/SmsReceiver;->processSend(Ljava/lang/String; Ljava/lang/String; Landroid/content/Context;)V (0x2e) ---> Landroid/telephony/SmsManager;->getDefault()Landroid/telephony/SmsManager;
1 Lcom/security/service/receiver/SmsReceiver;->processSend(Ljava/lang/String; Ljava/lang/String; Landroid/content/Context;)V (0x3c) ---> Landroid/telephony/SmsManager;->sendTextMessage(Ljava/lang/String; Ljava/lang/String; Ljava/lang/String; Landroid/app/PendingIntent; Landroid/app/PendingIntent;)V

Api Call
W ['Landroid/app/Notification;', 'defaults', 'I'] (0x4) ---> Landroid/support/v4/app/NotificationCompat$Builder;->setDefaults(I)Landroid/support/v4/app/NotificationCompat$Builder;
R ['Landroid/app/Notification;', 'defaults', 'I'] (0xb0) ---> Landroid/support/v4/app/NotificationCompatHoneycomb;->add(Landroid/content/Context; Landroid/app/Notification; Ljava/lang/CharSequence; Ljava/lang/CharSequence; Ljava/lang/CharSequence; Landroid/widget/RemoteViews; I Landroid/app/PendingIntent; Landroid/app/PendingIntent; Landroid/graphics/Bitmap;)Landroid/app/Notification;

IP Address
46.163.88.246
74.125.206.188
8.8.4.4